---
title: Contact and security — mdflow
description: Report mdflow bugs through GitHub issues and security vulnerabilities privately through GitHub Security Advisories.
url: https://mdflow.dev/contact/
---
# Contact and security

mdflow's public project contact is its [GitHub repository](https://github.com/johnlindquist/mdflow). Use the channels below so a reproducible bug, documentation correction, or security report reaches the appropriate place. This site does not offer a support inbox, contact form, or hosted account dashboard.

## Bugs, questions, and documentation

Search [existing GitHub issues](https://github.com/johnlindquist/mdflow/issues) before [opening an issue](https://github.com/johnlindquist/mdflow/issues/new). For a CLI problem, include the output of `md --version`, your operating system, the engine and its version, the command you ran, the observed result, and a minimal flow that reproduces the issue. Explain what you expected instead. Read the [contribution guide](https://github.com/johnlindquist/mdflow/blob/main/CONTRIBUTING.md) before proposing a change.

Issues are public. Remove credentials, private prompts, repository contents, and personal information before posting logs or diagnostics. `md explain` can include the resolved prompt and arguments; do not paste that output without reviewing it. You can also use issues to report an inaccurate page or ask a question about the website's privacy behavior without including sensitive data.

## Private vulnerability reports

Report vulnerabilities through [GitHub Security Advisories](https://github.com/johnlindquist/mdflow/security/advisories/new), not a public issue with exploit details. Include the affected version, reproduction steps, impact, and any suggested mitigation. The [security policy](https://github.com/johnlindquist/mdflow/blob/main/SECURITY.md) describes the acknowledgement target and supported-release policy; consult it for the current terms.

Treat downloaded flows and executable eval or hook sidecars as code. For permission boundaries and provider processing, see [the docs](https://mdflow.dev/docs/) and [privacy](https://mdflow.dev/privacy/). These GitHub channels are project-maintenance channels, not a promise of a commercial support service.